Extracted

• • Target

    8c9e69c484e159acd88a9c50d70db9f104d9cd804ac6855d657c077c54faa4acexe.exe

  • Size

    812KB

  • MD5

    7fa63943be0c41feebbf5e22cef17cd5

  • SHA1

    29e622e497c415607c0f7f7c911e223ac0212669

  • SHA256

    8c9e69c484e159acd88a9c50d70db9f104d9cd804ac6855d657c077c54faa4ac

  • SHA512

    695d16dc6a28e6f0ca3ac7458a09203b11191a90998812db9d82bfc3e0f66a8d01557c9460f5553e28ed0763fdbf66cd0d26d917c403a91d63912c8fe3a736a4

  • SSDEEP

    24576:o34/up+pJBLmeqhqCQoVNwL0aJKp//g0fo902jKFNe2qIa:o38PJRUQsyL0aJKBIL0DI2

  Score

  10^/10

  agentteslakeyloggerspywarestealertrojan

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2